Real-time threat detection
Continuous monitoring of file system activity with instant detection and removal of malware, trojans, ransomware and potentially unwanted programs. Dual-engine scanning on ClamAV and YARA runs entirely in-process.
Windows Security Software
x2y AV Ultimate
v8.5.0Comprehensive security suite for Windows. Real-time protection, threat intelligence with 5,500+ signatures, persistence auditing, and network monitoring. Protects your system without slowing it down.
Free — no account, no subscription, no telemetry. Donationware since July 2026.
Key features
Everything you need to protect a Windows machine, nothing you don't
Threat intelligence — 5,500+ signatures
Offline signature bundles sourced from MalwareBazaar (recent and full feeds), URLhaus malicious URL detection, OpenPhish phishing protection, and the ClamAV freshclam database. Updated manually — the app never phones home.
Persistence auditor
Deep analysis of startup entries, registry run keys, scheduled tasks, services and browser extensions. Identifies persistence mechanisms used by malware to survive reboots — before they activate.
Network activity monitor
Real-time process mapping and traffic flow visualisation. See every active connection — protocol, remote address, PID, process name, state and risk level — at a glance. Export to CSV for forensic analysis.
Quarantine vault
Suspicious files are isolated in an encrypted local vault — not deleted, not uploaded. Review, restore or permanently remove at your discretion. Full audit trail of every quarantine action.
Hash lookup — SHA256 / MD5
Compute and verify file hashes locally against known-good baselines. Integrity monitoring across 1,024+ watchpaths alerts on unexpected modification of binaries, configs and boot paths.
Threat sources
Open, auditable intelligence feeds
MalwareBazaar
RECENT + FULL FEEDS
URLhaus
MALICIOUS URL DETECTION
OpenPhish
PHISHING PROTECTION
ClamAV
FRESHCLAM DATABASE
How threat intel works. All signature feeds are downloaded as offline bundles and shipped with each release. You can also update them manually from the original sources. The application itself never connects to MalwareBazaar, URLhaus, OpenPhish or ClamAV servers — verification is possible with any network monitor.
Specifications
Technical details
| Product | x2y AV Ultimate |
|---|---|
| Version | v8.5.0 |
| Platform | Windows 10, Windows 11 |
| Architecture | x64 (64-bit) |
| Signatures | 5,500+ (offline bundle) |
| Engines | ClamAV 0.105, YARA 4.5 |
| Threat intel | MalwareBazaar, URLhaus, OpenPhish, ClamAV freshclam |
| Watchpaths | 1,024+ integrity monitor paths |
| Network monitor | Real-time TCP/UDP with process mapping |
| Quarantine | Encrypted local vault, restorable |
| Hash algorithms | SHA-256, MD5 |
| Export | CSV (network connections, scan reports) |
| Telemetry | 0 bytes — verified continuously |
| Account required | None — ever |
| Price | Free — donationware since Jul 2026 |
| Developer | x2y Devs Tools Ltd, Nairobi, Kenya |
Quick start
From download to protected in four steps
- 01
Download and verify
Get the installer from Microsoft Store, itch.io or GitHub. Verify the SHA-256 checksum against the published value.
- 02
Install
Run the signed installer. No administrator privileges required for standard installs. No account creation, no activation key.
- 03
Load engines
Signature bundles load from disk automatically. ClamAV and YARA initialise with 5,500+ offline signatures. The integrity monitor arms 1,024+ watchpaths.
- 04
Scan and monitor
Run a full scan, enable real-time protection, or open the Network Monitor. Every verdict is reached locally. Telemetry sent: 0 B.
CLIx2y-av --scan C:\Projects --engines clamav,yara --report localresolving engines ............ clamav 0.105 · yara 4.5loading signatures ........... 5,500+ · offline bundleintegrity monitor ............ armed · 1,024 watchpathsnetwork egress ............... blocked by designscanning 12,847 files ........ done in 41.2 s✓ verdict: CLEAN · threats 0 · telemetry sent 0 B
Downloads
Get x2y AV Ultimate v8.5.0
Verify before installing. Every release is signed and accompanied by a published SHA-256 checksum. Compare the hash of your download against the value on the GitHub release page before running the installer.
Changelog
Release history
MAR 2026v8.5.0
Threat intelligence refresh to 5,500+ signatures. New persistence auditor module. Network activity monitor with real-time process mapping and traffic flow graph. Hardened installer with published SHA-256 checksums.
DEC 2025v7.0.0
New dual-engine detection pipeline (ClamAV + YARA). Integrity monitor with configurable watchpaths. Quarantine vault with encrypted local storage.
OCT 2025v6.x
Initial public launch. Core scanning engine, basic threat detection, Windows 10/11 support.
Security model
Privacy enforced by architecture, not promises
Data policy. Telemetry: 0 bytes collected. Account required: none, ever. Data egress: none by design. Scan engines: ClamAV and YARA (open source). Threat intel: MalwareBazaar, URLhaus, OpenPhish (loaded offline). Updates: signed releases via GitHub with published SHA-256 checksums. Licence: free, donationware.
Every claim above is independently verifiable. Run Wireshark, Fiddler, GlassWire, or your operating system's firewall logs while using x2y AV Ultimate. You will observe zero outbound connections attributable to the application. We encourage this verification.
| Telemetry | 0 bytes collected |
|---|---|
| Account | None required — ever |
| Data egress | None by design |
| Engines | ClamAV 0.105 · YARA 4.5 |
| Threat feeds | Offline bundles only |
| Quarantine | Encrypted local vault |
| Installer | Signed · SHA-256 published |
| Verification | Any network monitor |
Ready to protect your system
Download x2y AV Ultimate — free, offline, forever
No account. No subscription. No telemetry. Just comprehensive Windows security that works when the network is off.
| Version | v8.5.0 |
|---|---|
| Platform | Windows 10 / 11 |
| Price | Free — donationware |
| Telemetry | 0 bytes |